ConSpec - A formal language for policy specification

Science of Computer Programming

Volumn 74, Issue 1-2, 2008, Pages 2-12

  Aktug, Irem ^a   Naliuka, Katsiaryna ^b  

^a ROYAL INSTITUTE OF TECHNOLOGY   (Sweden)

^b UNIVERSITY OF TRENTO   (Italy)

Author keywords

Policy language; Runtime monitoring; Security enforcement mechanisms; Security frameworks

Indexed keywords

FORMAL LANGUAGES; FORMAL METHODS; INFORMATION THEORY; SEMANTICS; SPECIFICATIONS; TRANSLATION (LANGUAGES);

FORMAL SEMANTICS; LIFE-CYCLE; POLICY ENFORCEMENTS; POLICY LANGUAGE; POLICY SPECIFICATION LANGUAGES; POLICY SPECIFICATIONS; RUNTIME MONITORING; SECURITY ENFORCEMENT MECHANISMS; SECURITY FRAMEWORKS;

LINGUISTICS;

EID: 56349132805     PISSN: 01676423     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.scico.2008.09.004     Document Type: Article

References (19)

1. I. Aktug, M. Dam, D. Gurov, Provably correct runtime monitoring, in: Proceedings of the 15th International Symposium on Formal Methods, FM'08, in: Lecture Notes in Computer Science, vol. 5014, Turku, Finland, May 2008, pp. 262-277
2. L. Bauer, J. Ligatti, D. Walker, Composing security policies with Polymer, in: Proc. of the ACM SIGPLAN Conf. on Prog. Lang. Design and Implementation, 2005, pp. 305-314
3. L. Bauer, J. Ligatti, D. Walker, Composing expressive run-time security policies, ACM Transactions on Software Engineering and Methodology, 2008 (in press)
4. Courcoubetis C., Vardi M., Wolper P., and Yannakakis M. Memory-efficient algorithms for the verification of temporal properties. Formal Methods in System Design 1 2-3 (1992) 275-288
5. N. Dragoni, F. Massacci, K. Naliuka, I. Siahaan, Security-by-contract: Toward a semantics for digital signatures on mobile code, in: European PKI Workshop: Theory and Practice, 2007 (in press)
6. Ú. Erlingsson, The inlined reference monitor approach to security policy enforcement, Ph.D. Thesis, Dep. of Computer Science, Cornell University, 2004
7. Hamlen K.W., Morrisett G., and Schneider F.B. Computability classes for enforcement mechanisms. ACM Transactions on Programming Languages and Systems 28 1 (2006) 175-205
8. Havelund K., and Rosu G. Efficient monitoring of safety properties. International Journal on Software Tools for Technology Transfer (STTT) 6-2 (2004) 158-173
9. Holzmann G.J. The model checker SPIN. Software Engineering 23 5 (1997) 279-295
10. Hopcroft J.E. On the equivalence and containment problems for context-free languages. Theory of Computing Systems 3 2 (1969) 119-124
11. Hunt H.B., and Rosenkrantz D.J. On equivalence and containment problems for formal languages. Journal of ACM 24 3 (1977) 387-396
12. Kesten Y., Manna Z., McGuire H., and Pnueli A. A decision algorithm for full propositional temporal logic. CAV (1993) 97-109
13. Ligatti J., Bauer L., and Walker D. Edit automata: Enforcement mechanisms for run-time security policies. International Journal of Information Security 4 1-2 (2005) 2-16 (Published online 26 Oct 2004)
14. F. Massacci, I. Siahaan, Matching midlet's security claims with a platform security policy using automata modulo theory, in: in Proc. of The 12th Nordic Workshop on Secure IT Systems, NordSec'07, October 2007
15. Necula G.C. Proof-carrying code. POPL '97: Proceedings of the 24th ACM SIGPLAN-SIGACT symposium on Principles of programming languages (1997), ACM Press, New York, NY, USA 106-119
16. Schneider F.B. Enforceable security policies. ACM Transactions on Infinite Systems Security 3 1 (2000) 30-50
17. Sekar R., Venkatakrishnan V.N., Basu S., Bhatkar S., and DuVarney D.C. Model-carrying code: A practical approach for safe execution of untrusted applications. ACM SIGOPS Operating Systems Review (2003)
18. D. Vanoverberghe, F. Piessens, A caller-side inline reference monitor for an object-oriented intermediate language, in: Proc. of the 10th IFIP International Conference on Formal Methods for Open Object-based Distributed Systems, FMOODS'08, Oslo, Norway, June 4-6, 2008, in: Lecture Notes in Computer Science, vol. 5051, Springer, 2008, pp. 240-258
19. A. Zobel, C. Simoni, D. Piazza, X. Nunez, D. Rodriguez, Business case and security requirements, Public Deliverable D5.1.1, S3MS. http://s3ms.org, October 2006